{
  "@id": "urn:uuid:d6d0df8d-a389-4f42-a746-a230fe37c60f",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 44,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T14:58:56.128088+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.1.4-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.1.4-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-31T03:04:52.163751+00:00",
      "status_notes": "Vulnerability CVE-2022-22950 does not affect version 6.1.4-tuxcare.6 of org.springframework:spring-expression. not_affected \u2014 Spring Framework 6.1.4 is NOT vulnerable to CVE-2022-22950 (SpEL DoS via large array allocation). The upstream fix by Sam Brannen (commit 83ac65915871067c39a4fb255e0d484c785c0c11) was already included in Spring Framework 6.1.4 when TuxCare onboarded it. The fix adds MAX_ARRAY_ELEMENTS validation (256K limit) in ConstructorReference.createArray() to prevent memory exhaustion. All array creation ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22950"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.1.4 is NOT vulnerable to CVE-2022-22950 (SpEL DoS via large array allocation). The upstream fix by Sam Brannen (commit 83ac65915871067c39a4fb255e0d484c785c0c11) was already included in Spring Framework 6.1.4 when TuxCare onboarded it. The fix adds MAX_ARRAY_ELEMENTS validation (256K limit) in ConstructorReference.createArray() to prevent memory exhaustion. All array creation ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.1.4-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.1.4-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-31T03:39:10.608887+00:00",
      "status_notes": "Vulnerability CVE-2023-20861 does not affect version 6.1.4-tuxcare.6 of org.springframework:spring-expression. not_affected \u2014 Spring Framework 6.1.4 is not affected by CVE-2023-20861. The vulnerability involves a DoS condition where specially crafted SpEL expressions with multiple `matches` operations using the same regex pattern cause excessive CPU consumption due to repeated pattern compilation. The fix (shared pattern cache at parser level) was already present in the upstream Spring Framework 6.1.4 release before T...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-20861"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.1.4 is not affected by CVE-2023-20861. The vulnerability involves a DoS condition where specially crafted SpEL expressions with multiple `matches` operations using the same regex pattern cause excessive CPU consumption due to repeated pattern compilation. The fix (shared pattern cache at parser level) was already present in the upstream Spring Framework 6.1.4 release before T..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.1.4-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.1.4-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-31T01:29:05.284168+00:00",
      "status_notes": "Vulnerability CVE-2023-20863 does not affect version 6.1.4-tuxcare.6 of org.springframework:spring-expression. not_affected \u2014 CVE-2023-20863 (SpEL DoS) is not present in Spring Framework 6.1.4. The vulnerability involves denial-of-service through extremely long SpEL expressions. The upstream fix (expression length validation with 10,000 character default limit) was already included in Spring Framework 6.1.4 when released. The defense is implemented in InternalSpelExpressionParser.checkExpressionLength() and is active ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-20863"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-20863 (SpEL DoS) is not present in Spring Framework 6.1.4. The vulnerability involves denial-of-service through extremely long SpEL expressions. The upstream fix (expression length validation with 10,000 character default limit) was already included in Spring Framework 6.1.4 when released. The defense is implemented in InternalSpelExpressionParser.checkExpressionLength() and is active ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.1.4-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.1.4-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-02T14:58:56.128088+00:00",
      "status_notes": "Vulnerability CVE-2024-38808 affects version 6.1.4-tuxcare.6 of org.springframework:spring-expression, and is fixed in 6.1.4-tuxcare.9.",
      "vulnerability": {
        "name": "CVE-2024-38808"
      },
      "action_statement": "Vulnerability CVE-2024-38808 affects version 6.1.4-tuxcare.6 of org.springframework:spring-expression, and is fixed in 6.1.4-tuxcare.9."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.1.4-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.1.4-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-30T10:20:00.109102+00:00",
      "status_notes": "Vulnerability CVE-2026-41849 does not affect version 6.1.4-tuxcare.6 of org.springframework:spring-expression. Spring Framework 6.1.4 builds repeated text with the JDK's String.repeat. If the int size check in OpMultiply overflows, String.repeat rejects the request with an OutOfMemoryError before allocating any memory, so the CVE-2026-41849 denial of service cannot occur. The vendor lists only 5.3.x as affected.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-41849"
      },
      "impact_statement": "Spring Framework 6.1.4 builds repeated text with the JDK's String.repeat. If the int size check in OpMultiply overflows, String.repeat rejects the request with an OutOfMemoryError before allocating any memory, so the CVE-2026-41849 denial of service cannot occur. The vendor lists only 5.3.x as affected."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.1.4-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.1.4-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41850 is fixed in version 6.1.4-tuxcare.6 of org.springframework:spring-expression.",
      "vulnerability": {
        "name": "CVE-2026-41850"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.1.4-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.1.4-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-21T16:35:00.322171+00:00",
      "status_notes": "Vulnerability CVE-2026-41851 affects version 6.1.4-tuxcare.6 of org.springframework:spring-expression, and is fixed in 6.1.4-tuxcare.8.",
      "vulnerability": {
        "name": "CVE-2026-41851"
      },
      "action_statement": "Vulnerability CVE-2026-41851 affects version 6.1.4-tuxcare.6 of org.springframework:spring-expression, and is fixed in 6.1.4-tuxcare.8."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.1.4-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.1.4-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41852 is fixed in version 6.1.4-tuxcare.6 of org.springframework:spring-expression.",
      "vulnerability": {
        "name": "CVE-2026-41852"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.1.4-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.1.4-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-47886 is fixed in version 6.1.4-tuxcare.6 of org.springframework:spring-expression.",
      "vulnerability": {
        "name": "CVE-2026-47886"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.1.4-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.1.4-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59283 is fixed in version 6.1.4-tuxcare.6 of org.springframework:spring-expression.",
      "vulnerability": {
        "name": "CVE-2026-59283"
      }
    }
  ]
}